Examples with CertificateValidationContext io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext used on opensource projects

Example 1 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class SdsX509TrustManagerTest method wildcardSanInPeerCertsVerifiesMultipleVerifySans.

@Test
public void wildcardSanInPeerCertsVerifiesMultipleVerifySans() throws CertificateException, IOException {
    StringMatcher stringMatcher = StringMatcher.newBuilder().setExact("x.foo.com").build();
    StringMatcher stringMatcher1 = StringMatcher.newBuilder().setSuffix("test.youTube.Com").setIgnoreCase(true).build();
    CertificateValidationContext certContext = CertificateValidationContext.newBuilder().addMatchSubjectAltNames(stringMatcher).addMatchSubjectAltNames(// should match suffix test.youTube.Com
    stringMatcher1).build();
    trustManager = new SdsX509TrustManager(certContext, mockDelegate);
    X509Certificate[] certs = CertificateUtils.toX509Certificates(TestUtils.loadCert(SERVER_1_PEM_FILE));
    trustManager.verifySubjectAltNameInChain(certs);
}

Example 2 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class SdsX509TrustManagerTest method oneSanInPeerCerts_substringIgnoreCase.

@Test
public void oneSanInPeerCerts_substringIgnoreCase() throws CertificateException, IOException {
    StringMatcher stringMatcher = StringMatcher.newBuilder().setContains("zooI.Test.Google").setIgnoreCase(true).build();
    CertificateValidationContext certContext = CertificateValidationContext.newBuilder().addMatchSubjectAltNames(stringMatcher).build();
    trustManager = new SdsX509TrustManager(certContext, mockDelegate);
    X509Certificate[] certs = CertificateUtils.toX509Certificates(TestUtils.loadCert(SERVER_1_PEM_FILE));
    trustManager.verifySubjectAltNameInChain(certs);
}

Example 3 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class SdsX509TrustManagerTest method wildcardSanInPeerCertsVerifiesMultipleVerifySans1.

@Test
public void wildcardSanInPeerCertsVerifiesMultipleVerifySans1() throws CertificateException, IOException {
    StringMatcher stringMatcher = StringMatcher.newBuilder().setExact("x.foo.com").build();
    StringMatcher stringMatcher1 = StringMatcher.newBuilder().setContains("est.Google.f").setIgnoreCase(true).build();
    CertificateValidationContext certContext = CertificateValidationContext.newBuilder().addMatchSubjectAltNames(stringMatcher).addMatchSubjectAltNames(// should contain est.Google.f
    stringMatcher1).build();
    trustManager = new SdsX509TrustManager(certContext, mockDelegate);
    X509Certificate[] certs = CertificateUtils.toX509Certificates(TestUtils.loadCert(SERVER_1_PEM_FILE));
    trustManager.verifySubjectAltNameInChain(certs);
}

Example 4 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class SdsX509TrustManagerTest method oneSanInPeerCertsSuffix_differentCase_expectException.

@Test
public void oneSanInPeerCertsSuffix_differentCase_expectException() throws CertificateException, IOException {
    StringMatcher stringMatcher = StringMatcher.newBuilder().setSuffix(".gooGle.bE").setIgnoreCase(false).build();
    CertificateValidationContext certContext = CertificateValidationContext.newBuilder().addMatchSubjectAltNames(stringMatcher).build();
    trustManager = new SdsX509TrustManager(certContext, mockDelegate);
    X509Certificate[] certs = CertificateUtils.toX509Certificates(TestUtils.loadCert(SERVER_1_PEM_FILE));
    try {
        trustManager.verifySubjectAltNameInChain(certs);
        fail("no exception thrown");
    } catch (CertificateException expected) {
        assertThat(expected).hasMessageThat().isEqualTo("Peer certificate SAN check failed");
    }
}

Example 5 with CertificateValidationContext

use of io.envoyproxy.envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext in project grpc-java by grpc.

the class SdsX509TrustManagerTest method oneSanInPeerCertsVerifies_ignoreCase.

@Test
public void oneSanInPeerCertsVerifies_ignoreCase() throws CertificateException, IOException {
    StringMatcher stringMatcher = StringMatcher.newBuilder().setExact("Waterzooi.Test.google.be").setIgnoreCase(true).build();
    CertificateValidationContext certContext = CertificateValidationContext.newBuilder().addMatchSubjectAltNames(stringMatcher).build();
    trustManager = new SdsX509TrustManager(certContext, mockDelegate);
    X509Certificate[] certs = CertificateUtils.toX509Certificates(TestUtils.loadCert(SERVER_1_PEM_FILE));
    trustManager.verifySubjectAltNameInChain(certs);
}